Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org F1F2DC447A0
From:   Kalle Valo <kvalo@codeaurora.org>
To:     qize wang <wangqize888888888@gmail.com>
Cc:     linux-wireless@vger.kernel.org, amitkarwar@gmail.com,
        nishants@marvell.com, gbhat@marvell.com, huxinming820@gmail.com,
        kvalo@codeaurora.org, greg@kroah.com, dan.carpenter@oracle.com,
        solar@openwall.com
Subject: Re: [PATCH v3] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
References: <20191129101054.2756-1-wangqize888888888@gmail.com>
Date:   Mon, 2 Dec 2019 14:54:52 +0000
In-Reply-To: <20191129101054.2756-1-wangqize888888888@gmail.com> (qize wang's
        message of "Fri, 29 Nov 2019 18:10:54 +0800")
Message-ID: <0101016ec71b6643-65bb0c52-29a0-456e-aa6d-6a4649e28a03-000000@us-west-2.amazonses.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Feedback-ID: 1.us-west-2.CZuq2qbDmUIuT3qdvXlRHZZCpfZqZ4GtG9v3VKgRyF0=:AmazonSES
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

qize wang <wangqize888888888@gmail.com> writes:

> mwifiex_process_tdls_action_frame() without checking
> the incoming tdls infomation element's vality before use it,
> this may cause multi heap buffer overflows.
>
> Fix them by putting vality check before use it.
>
> IE is TLV struct, but ht_cap and  ht_oper aren=E2=80=99t TLV struct.
> the origin marvell driver code is wrong:
>
> memcpy(&sta_ptr->tdls_cap.ht_oper, pos,....
> memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos,...
>
> Fix the bug by changing pos(the address of IE) to
> pos+2 ( the address of IE value ).
>
> v3: change commit log
>
> Signed-off-by: qize wang <wangqize888888888@gmail.com>

Applied manually (removed the changelog from commit), thanks.

1e58252e334d mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_fra=
me()

--=20
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatc=
hes